Dataviz logoDataviz
LoginBook a Demo
§ Trust

What “trust” means at DemanualAI.

Trust is a product decision before it is a marketing one. Dataviz connects to live customer databases, so every architectural choice we make is anchored to a small set of principles: read-only by design, store the recipe not the ingredients, defence in depth, and isolation by default. This page is where we keep our work honest — what we shipped, what we're still building, and what an enterprise security team would need to evaluate us properly.

§ Build Progress

Last 90 days
of shipping.

Production · 99.7% uptime · 2 months

March 18, 2026

Network security and data management

  • TLS enforcement and rate limiting — all traffic encrypted at the edge with comprehensive DDoS and attack mitigation. Requests throttled to prevent abuse and ensure service stability.
  • Security headers deployed — application-layer defences in place across all request types, with per-IP rate limiting to maintain service reliability during peak usage.
  • Archive and retention system — users can now archive conversations and reports across all channels. Automated retention policies ensure data is managed according to compliance requirements.
March 15, 2026

Model refinement and fallback handling

  • Primary model stabilized — LLM model performance verified across all pipeline stages (query generation, result formatting, report planning, assembly). Consistent output quality confirmed in production.
  • Graceful degradation — system now returns human-readable explanations when a query cannot be executed, instead of retrying or failing. Users understand what data is available and can refine their question.
  • Message validation strengthened — incoming messages validated with cryptographic verification to ensure authenticity and prevent spoofing across all integration channels.
March 5, 2026

Query understanding and confidence scoring

  • Intent routing refined — system now classifies incoming queries to determine appropriate handling. Conversational follow-ups are routed intelligently, avoiding unnecessary database calls.
  • Reproducible confidence scores — replaced heuristic scoring with a deterministic weighted algorithm based on query validation, schema coverage, and result quality. Users see honest accuracy indicators.
  • Date and schema validation — queries are validated against available data ranges and schema before execution. Users are informed when data doesn't exist for their requested time period.
  • Result rendering robustness — charts and visualizations now handle edge cases gracefully—single-row data, missing fields, and formatting errors no longer cause failures.
§ Compliance

Certifications and assessments.

Current status, including in-progress items. If your security team asks for a SOC 2 Type II or pen test report before they're complete, we provide: (a) the current security whitepaper, (b) a written attestation of the controls in place, and (c) a target completion date.

FrameworkStatusNotes
GDPRCompliant (core controls)DPA available on request; SCCs in place via AWS and Supabase.
DPDP Act 2023 (India)Compliant (core controls)Grievance officer designated.
OWASP Top 10AddressedAWS WAF Managed Rule Sets + application-layer controls (3-stage SQL validation, prompt-injection defence, RLS isolation).
SOC 2 Type IIIn progress — Q3 2026Controls in place; engaged with auditor for the formal assessment. Type I report expected Q2 2026, Type II following the observation window.
External penetration testIn progressScoped engagement underway covering the API surface, NL2SQL pipeline (prompt injection + SQL validation), and tenant isolation. Summary findings will be made available to prospective customers under NDA when complete.
ISO 27001Not pursued yetWe will revisit once we close five enterprise customers — the cost-to-value math gets clear at that scale.
§ Security

Four principles that guide every choice.

Zero data retention

We store the recipe (the SQL we generate), not the ingredients (the rows your database returns). Query results pass through the system to your browser and are not persisted. Cache entries have configurable TTLs and auto-evict.

Read-only by design

We cannot modify, insert, or delete data in your database. This is enforced at three independent layers: the LLM system prompt, the SQL validator (sqlglot AST parsing), and the database connector itself. Even if all three were bypassed, we ask you to provide a read-only database user.

Tenant isolation

Every customer's data is separated by Row-Level Security at the PostgreSQL layer. The audit log uses RLS policies with USING (false) on UPDATE and DELETE — even our own application cannot modify history. A dedicated test suite verifies isolation across 15+ tables on every release.

Defence in depth

Network: CloudFront + WAF + TLS 1.2+. Application: rate limiting, security headers, prompt-injection scanning. AI: 3-stage SQL validation (syntax → schema → EXPLAIN). Credentials: AES-256-GCM in Supabase Vault, decrypted only at query time, every access audited.

Download the full Security Whitepaper (PDF)
§ Infrastructure

Sub-processors and compliance.

We notify customers at least 30 days before adding or replacing a sub-processor. Customers may object in writing within 15 days, and we will work to resolve the objection or offer a path to terminate the affected service.

Sub-processorPurposeRegionCompliance
SupabaseDatabase, authentication, storage, vaultAWS-managedSOC 2 Type II, GDPR
Amazon Web ServicesCompute (EC2), CDN (CloudFront), AI (Bedrock), WAFap-south-1 (Mumbai), us-east-1SOC 2, ISO 27001, GDPR
TwilioWhatsApp messagingUSSOC 2, GDPR
Slack TechnologiesSlack bot integrationUSSOC 2, ISO 27001
§ Resources

Legal documents and contacts.

Inquiries & Support

Sales & contracts

sanjay@demanualai.com